Abstract

This class is planned and organized to introduce attendees to reverse engineering of non-binaries (non-PE format), which covers multiple formats such as .lnk files, obfuscated and encrypted python files, obfuscated PowerShell scripts, JavaScript files and other ones. This training offers a very practical approach and provide students with techniques for solving and handling different real-world samples, and retrieving important artifacts.

We will provide students with important concepts about multiple file formats, and such concepts will be used as foundation to understand complicated scenarios while analyzing malicious files. Therefore, student will learn how to build an appropriate lab setup with simple tools that will be used along the training. Additionally, attendees will be exposed to real world samples that demands creative approaches for retrieving key artifacts. This course is focused on static analysis, which requires to write short Python scripts and use several commands on Linux and Windows systems. Finally, the instructor solves a series of samples for helping students in builing the necessary first-experience in this kind of analysis.

This class will focus on non-binaries (non-PE format) running on x86/x64 Windows, but attendees will use actively Linux environment over all the traiing.

Attendees must be advised that this is an intensive course.

Who Should Attend

This class is designed for professionals who want to start the malware analysis and reverse engineering career, and also that are currently working as analysts, incident responders and threat hunters.

Key Learning Objectives

Students attending this class will:

  • Learn fundamental conceps on different file formats.
  • Learn effective and practical approaches to triage non-binary files
  • Practice different techniques to deobfuscate multiple samples in PowerShell, Python and other formats.
  • Learn how decryt malicious encrypted files.
  • Effective learn and practive the new-acquired skills on real-world samples.

Prerequisite Knowledge

The recommended prior knowledge for attending this class follows below:

  • Students should be comfortable in running commands on operating system such Windows and Linux.
  • Having previous knowledge in any programming language could be useful, but it is not a requirement.
  • Basic knowledge on obfuscation techniques are useful, but it is not a requirement.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • One virtual machine running Ubuntu 22.04+ or REMnux.
  • One virtual machine running Windows 11 x64.
  • Malwoverview installed on both virtual machines, including all necessary APIs already configured.
  • Visual Studio Code installed on both Linux and Windows virtual machines.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class is:

  • Introduction
  • Lab Setup
  • Radare2 Crash-Course.
  • Frida
  • Lnk file analysis
  • Malicious and Obfuscated Python file analysis.
  • Obfuscated PowerShell file analysis.
  • Obfuscated JavaScript file analysis.
  • Other malicious format files.

Note: Topics can be added, merged or removed without prior notice!